@expo/code-review-cli 0.6.0 → 0.7.0

package/build/sources/github-pr.js

@@ -1,9 +1,9 @@
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
-import { run } from "../core/exec.js";
+import { resolveTrustedTool, run } from "../core/exec.js";
 import { parseUnifiedDiff } from "../core/diff.js";
-import { scrubAmbientRuntimeConfig } from "../core/scrub.js";
+import { removeEscapingSymlinks, scrubAmbientRuntimeConfig } from "../core/scrub.js";
 /** A full 40-hex-char commit OID — the only ref form passed to security-sensitive git calls. */
 export function isCommitOid(value) {
     return typeof value === "string" && /^[0-9a-f]{40}$/i.test(value);
@@ -38,7 +38,8 @@ export class GitHubPRSource {
         return (this.metadataPromise ??= this.fetchMetadata());
     }
     async fetchMetadata() {
-        const { stdout } = await run("gh", [
+        const gh = await resolveTrustedTool("gh");
+        const { stdout } = await run(gh, [
             "pr",
             "view",
             String(this.options.prNumber),
@@ -60,7 +61,8 @@ export class GitHubPRSource {
         };
     }
     async getChangedFiles() {
-        const { stdout } = await run("gh", ["pr", "diff", String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
+        const gh = await resolveTrustedTool("gh");
+        const { stdout } = await run(gh, ["pr", "diff", String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
         return parseUnifiedDiff(stdout);
     }
     /**
@@ -77,21 +79,22 @@ export class GitHubPRSource {
         }
         const cwd = this.options.cwd;
         const url = `https://github.com/${this.options.repo}.git`;
+        const gitPath = await resolveTrustedTool("git");
         let parent;
         try {
-            await run("git", [...GH_CREDENTIAL_HELPER_ARGS, "fetch", "--no-tags", "--depth=1", url, ref], { cwd });
+            await run(gitPath, [...GH_CREDENTIAL_HELPER_ARGS, "fetch", "--no-tags", "--depth=1", url, ref], { cwd });
             parent = await mkdtemp(path.join(tmpdir(), "ecr-tree-"));
             const dir = path.join(parent, "tree"); // must not pre-exist for `worktree add`
             // Check out the OID (not FETCH_HEAD): if the ref moved between the API call
             // and this fetch, the OID is absent and this fails instead of silently
             // materializing a different tree than the one the diff was fetched for.
-            await run("git", ["worktree", "add", "--detach", dir, oid], { cwd });
+            await run(gitPath, ["worktree", "add", "--detach", dir, oid], { cwd });
             const removeParent = parent;
             return {
                 dir,
                 cleanup: async () => {
                     try {
-                        await run("git", ["worktree", "remove", "--force", dir], { cwd });
+                        await run(gitPath, ["worktree", "remove", "--force", dir], { cwd });
                     }
                     catch {
                         // best effort — fall through to removing the temp dir
@@ -118,6 +121,9 @@ export class GitHubPRSource {
      * OpenCode server is started with this directory as its project root, and
      * anything it discovers there is attacker-controlled PR content executing or
      * injecting inside a process that holds the model credential and GH_TOKEN.
+     * Out-of-tree symlinks are stripped in the same pass: read tools are scoped by
+     * the literal path argument but follow symlinks underneath, so a PR-committed
+     * link escaping the tree would otherwise read arbitrary host files.
      *
      * Returns null only when no owner/repo is configured (a local `--pr` run
      * without --repo, where the current checkout is an acceptable read root).
@@ -136,6 +142,7 @@ export class GitHubPRSource {
         const root = await this.materializeWorktreeAsync(`refs/pull/${this.options.prNumber}/head`, metadata.headOid);
         try {
             await scrubAmbientRuntimeConfig(root.dir);
+            await removeEscapingSymlinks(root.dir);
         }
         catch (error) {
             // A half-scrubbed tree must never become the runtime's project root.

package/build/sources/local-git.js

@@ -1,4 +1,4 @@
-import { git, run } from "../core/exec.js";
+import { git, resolveTrustedTool, run } from "../core/exec.js";
 import { parseUnifiedDiff } from "../core/diff.js";
 /**
  * Reads local git state. No network calls. Default compares the working tree
@@ -94,7 +94,8 @@ export class LocalGitSource {
         const chunks = [];
         for (const file of files) {
             // `--` so a filename beginning with `-` can't be read as a git option.
-            const { stdout } = await run("git", ["diff", "--no-index", "--", "/dev/null", file], {
+            const gitPath = await resolveTrustedTool("git");
+            const { stdout } = await run(gitPath, ["diff", "--no-index", "--", "/dev/null", file], {
                 cwd: this.cwd,
                 check: false,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/code-review-cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Generic, config-driven AI code reviewer engine. Repos supply their agents via .expo-code-review/.",
   "license": "MIT",
   "repository": {
@@ -28,8 +28,8 @@
     "clean": "rimraf build",
     "typecheck": "tsc --noEmit",
     "lint": "oxlint src",
-    "fmt": "oxfmt src",
-    "fmt:check": "oxfmt --check src",
+    "fmt": "oxfmt --threads=1 src",
+    "fmt:check": "oxfmt --threads=1 --check src",
     "dev": "bun run src/cli.ts",
     "test:unit": "bun test",
     "release": "bash scripts/release.sh",

package/templates/config.jsonc

@@ -49,9 +49,9 @@
   //              store the key as a repo secret and pass it under that env var
   //              (the scaffolded workflow does). If you omit `auth` entirely,
   //              OpenCode's own login / ambient provider env vars are used.
-  // For Anthropic/Claude, set provider "anthropic", tokenEnv "ANTHROPIC_API_KEY",
-  // and an anthropic/... model above. For another provider, omit `auth` and set
-  // REVIEWER_MODEL after an `opencode auth login` for that provider.
+  // For Anthropic/Claude, see the dedicated block below (it now runs through the
+  // Claude Code CLI). For another provider, omit `auth` and set REVIEWER_MODEL
+  // after an `opencode auth login` for that provider.
   //
   // MIXED setup (a ChatGPT/Codex subscription for the default models, plus a
   // metered API key for pro-tier models the subscription doesn't offer): use the
@@ -65,6 +65,24 @@
   // (openai oauth: tokenEnv holds the ACCESS token from an `opencode auth login`
   // ChatGPT sign-in — `ecr setup-auth` extracts it. NEVER share the refresh
   // token: it is single-use and dies on first rotation.)
+  //
+  // Anthropic runs through the Claude Code CLI, inferred from the model — set your
+  // models to "anthropic/…" (e.g. anthropic/claude-opus-5, anthropic/claude-sonnet-5)
+  // and run `claude setup-token`, exporting the token as CLAUDE_CODE_OAUTH_TOKEN (CI)
+  // or rely on your local `claude` login. An auth entry is OPTIONAL (tokenEnv just
+  // names the credential env); `ecr setup-auth` walks you through it.
+  //   "auth": { "providers": {
+  //     "anthropic": { "tokenEnv": "CLAUDE_CODE_OAUTH_TOKEN" }
+  //   } }
+  //
+  // MIXING engines is supported: the engine is inferred per agent from its model, so
+  // an anthropic entry may coexist with an openai (or any other) OpenCode provider.
+  // Each agent's `model` selects its engine — an `anthropic/…` agent runs through the
+  // Claude Code CLI while an `openai/…` agent runs through OpenCode, in the SAME run.
+  //   "auth": { "providers": {
+  //     "anthropic": { "tokenEnv": "CLAUDE_CODE_OAUTH_TOKEN" },
+  //     "openai":    { "mode": "oauth", "tokenEnv": "CODEX_OAUTH_ACCESS_TOKEN" }
+  //   } }
   "auth": {
     "mode": "api-key",
     "provider": "openai",

package/templates/shared.md

@@ -63,6 +63,34 @@ firehose. When in doubt, stay silent.
 **For now, report only `critical` and `warning` findings. Do not emit
 `suggestion`-level items at all.**
 
+## Write findings in Simplified Technical English
+
+Your findings are read by engineers in many countries. Many of them do not speak
+English as a first language. Write every piece of prose you emit — `title`,
+`rationale`, `suggestion` — under the ASD-STE100 Simplified Technical English
+rules:
+
+- **One word, one meaning.** Choose one term for a thing and reuse it. Do not
+  alternate between synonyms for the same object ("the handler" / "the callback"
+  / "the hook").
+- **Short sentences.** Use 20 words or fewer. Split a long sentence into two.
+- **Active voice.** Write "the parser drops the flag", not "the flag is dropped
+  by the parser". Name the actor.
+- **Plain words.** Write "use", not "utilize"; "before", not "prior to";
+  "because", not "due to the fact that". Remove hedges ("arguably", "it seems
+  that") and intensifiers ("very", "extremely").
+- **One topic per paragraph.** Keep paragraphs short.
+- **No idiom, metaphor, or sarcasm.** State what happens.
+
+This rule is about prose only. `evidence` and any code you quote are copied
+verbatim and are never rewritten to fit these rules. Identifiers, file paths,
+error strings, and the `severity`/`category` values also stay exactly as they
+are.
+
+Simple language must not cost precision. Keep the concrete failure path, the
+condition that triggers it, and the names of the affected code. Short sentences
+are a way to say the same thing, not a way to say less.
+
 ## Output contract
 
 Return **only** a single fenced ```json code block, an object of this shape: